Cases GraphQL API¶
Query and manage cases — opened around related alerts, events, and other evidence — over GraphQL.
See the guide for a narrative walkthrough of this API.
This is a GraphQL API: every request is a POST carrying a query (or mutation) document, rather than one endpoint per operation. See the guide above for the request shape and authentication.
Queries¶
- case
case gets a single case. - caseComments
comments returns all the comments for a case - caseEvidence
caseEvidence returns the attached evidence for a case. - caseFile
caseFile returns file details for a single file attached to a case based on the arguments provided. The result will also include a pre-signed download url. - caseFiles
caseFiles returns file details for all files matching the arguments provided. Download URLs will be generated only if the downloadURL field is requested in the query. Note: Audit logs are created for all file downloads except embedded files (isEmbedded=true). To filter by embedded status, use CQL: query with isEmbedded=true or isEmbedded=false. - casePrimaryStatuses
casePrimaryStatuses returns the available case primary statuses for a given user and the current tenant's service level - casePrimaryVerdicts
casePrimaryVerdicts returns the available case primary verdicts for a given user and the current tenant's service level - caseRule
caseRule gets an auto-case rule - caseRules
caseRules returns a list of case rules matching the provided arguments. - caseSecondaryStatuses
caseSecondaryStatuses returns the available case statuses for a given user and the current tenant's service level - caseSecondaryVerdicts
caseSecondaryVerdicts returns the available case secondary verdicts for a given user and the current tenant's service level - caseSources
caseSources returns all available case sources, optionally filtered by transition rules. - caseTemplate
caseTemplate gets an auto-case template - caseTemplates
caseTemplates returns a list of case templates matching the provided arguments. - caseTypes
caseTypes returns the available case types for a given user and the current tenant's service level - cases
cases returns a list of cases matching the provided arguments.
Mutations¶
- addCaseComment
addCaseComment adds a comment to an existing case. - addEvidenceToCase
addEvidenceToCase will add more evidence to an existing case. Evidence added through this mutation will not be considered genesis evidence. The response will include the evidence that the service will attempt to add to the case. Adding evidence to cases is an asynchronous operation. It will typically finish pretty quickly, but added detections/events will may not show up in the returned case until the async job is fully complete. The processing status, that is found on the case type will reflect the state of the processing job. Once the status is set to 'SUCCESS' the background job is complete and requesting the case will return the related evidence. Adding, removing or updating evidence (closing a case) while other jobs are processing for a given case will cause the jobs to queue. Jobs will be worked through in the order they were received. - createCase
createCase creates new case with the provided arguments. - createCaseLink
createCaseLink creates a new link on an existing case. - createCaseRule
createCaseRule accepts input to create a new auto-case rule. - createCaseTemplate
createCaseTemplate accepts input to create a new auto-case template. - deleteCaseComment
deleteCaseComment removes an existing comment from a case. This is a hard delete. Data will not be recoverable. - deleteCaseFile
deleteCaseFile removes an existing file from a case. This is a hard delete. Data will not be recoverable. - deleteCaseLink
deleteCaseLink deletes an existing link from a case. - deleteCaseRule
deleteCaseRule removes an existing case rule. This is a hard delete. Data will not be recoverable. - deleteCaseTemplate
deleteCaseTemplate removes an existing case template. This is a hard delete. Data will not be recoverable. - mergeCase
mergeCase associates source evidence to a target case. Source cases are transitioned and may be archived. Evidence association is asynchronous. - removeEvidenceFromCase
removeEvidenceFromCase will remove evidence from an existing case. The response will include the evidence that the service will attempt to remove from the case. Removing evidence from cases is an asynchronous operation. It will typically finish pretty quickly, but removed detections/events will can remain attached to the case until the async job is fully complete. The processing status, that is found on the case type will reflect the state of the processing job. Once the status is set to 'SUCCESS' the background job is complete and requesting the case will only return evidence that was not removed. Adding, removing or updating evidence (closing a case) while other jobs are processing for a given case will cause the jobs to queue. Jobs will be worked through in the order they were received. - splitCase
splitCase creates one new destination case and moves the selected case evidence to it asynchronously. Only detections, events, saved searches, and files can be moved. Key findings, comments, entities, and agents remain on the source case. Requested evidence not attached to the source case (already removed, or never present) is silently ignored — only what is still attached when the move runs is moved; the rest is recorded in the audit trail as skipped. SCHEDULED attachments (upload link issued but file not yet uploaded) are likewise skipped and left on the source. - startCaseFileUpload
startCaseFileUpload initializes a file upload for a case. The response will include a pre-signed URL that can be used to upload a file to the case. - updateCase
updateCase updates an existing case. This is a PATCH style mutation, only fields that are send in the input will be updated. - updateCaseComment
updateCaseComment updates an existing comment on a case. This is a PATCH style mutation, only fields that are send in the input will be updated. Only the user who created the comment can update it. Updating a comment and adding new @mentions will trigger new notifications but will not send notifications to @mentions that are already present in the comment. - updateCaseLink
updateCaseLink updates an existing link on a case. - updateCaseRule
updateCaseRule accepts input to update an existing auto-case rule. - updateCaseTemplate
updateCaseTemplate accepts input to update an existing auto-case template.
Types¶
AddCaseCommentAddEvidenceToCaseInputAddEvidenceToCaseResultCaseCaseArgumentsCaseAssetEvidenceCaseCommentCaseCommentVisibilityFilterCaseCommentsCaseCommentsArgumentsCaseDetectionEvidenceCaseEventEvidenceCaseEvidenceCaseEvidenceArgumentsCaseFileCaseFileArgumentsCaseFileMetaCaseFileUploadCaseFilesCaseFilesArgumentsCaseLinkCaseManagedByCasePrimaryStatusCasePrimaryStatusesCasePrimaryStatusesArgumentsCasePrimaryVerdictCasePrimaryVerdictsCasePrimaryVerdictsArgumentsCaseProcessingStateCaseProcessingStatusCaseQueueCaseRuleCaseRuleArgumentsCaseRuleStateCaseRuleTypeCaseRulesCaseRulesArgumentsCaseSearchQueryEvidenceCaseSecondaryStatusCaseSecondaryStatusesCaseSecondaryStatusesArgumentsCaseSecondaryVerdictCaseSecondaryVerdictsCaseSecondaryVerdictsArgumentsCaseSourceCaseSourcesCaseSourcesArgumentsCaseTemplateCaseTemplateArgumentsCaseTemplatesCaseTemplatesArgumentsCaseTypeCaseTypesCaseTypesArgumentsCasesCasesArgumentsCasesPaginationCreateCaseInputCreateCaseLinkInputCreateCaseQueueInputCreateCaseRuleInputCreateCaseTemplateInputCreateKeyFindingsDocumentInputCreateKeyFindingsTemplateInputCursorPaginationDeleteCaseCommentInputDeleteCaseFileInputDeleteCaseLinkInputDeleteCaseRuleInputDeleteCaseTemplateInputDetectionSeverityDocumentTypeIncidentAdvisorJSONObjectKeyFindingsDocumentKeyFindingsTemplateMergeCaseInputMergeCaseResultOffsetPaginationPageInfoPaginationOrderRemoveEvidenceFromCaseInputRemoveEvidenceFromCaseResultSplitCaseInputSplitCaseResultStartCaseFileUploadInputSubjectTemplateUsageTenantV4TimeUpdateCaseCommentInputUpdateCaseInputUpdateCaseLinkInputUpdateCaseQueueInputUpdateCaseRuleInputUpdateCaseTemplateInputUpdateKeyFindingsDocumentInputUpdateKeyFindingsTemplateInput